CVE-2021-45046: Apache Log4j2 Deserialization of Untrusted Data Vulnerability

Critical severity, CVSS 9.0. Actively exploited: in CISA KEV since 2023-05-01. EPSS: 100% chance of exploitation in the next 30 days.

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

Affected products

  • Apache LOG4J: from 2.0.1, before 2.12.2 (fixed in 2.12.2); from 2.13.0, before 2.16.0 (fixed in 2.16.0); version 2.0 only
  • Cvat Computer Vision Annotation Tool: affected versions not specified
  • Debian Debian Linux: version 10.0 only; version 11.0 only
  • Fedoraproject Fedora: version 34 only; version 35 only
  • Intel Audio Development Kit: affected versions not specified
  • Intel Datacenter Manager: affected versions not specified
  • Intel Genomics Kernel Library: affected versions not specified
  • Intel Oneapi: affected versions not specified
  • Intel Secure Device Onboard: affected versions not specified
  • Intel Sensor Solution Firmware Development Kit: affected versions not specified
  • Intel System Debugger: affected versions not specified
  • Intel System Studio: affected versions not specified
  • Siemens 6bk1602-0aa12-0tp0 Firmware: before 2.7.0 (fixed in 2.7.0)
  • Siemens 6bk1602-0aa22-0tp0 Firmware: before 2.7.0 (fixed in 2.7.0)
  • Siemens 6bk1602-0aa32-0tp0 Firmware: before 2.7.0 (fixed in 2.7.0)
  • Siemens 6bk1602-0aa42-0tp0 Firmware: before 2.7.0 (fixed in 2.7.0)
  • Siemens 6bk1602-0aa52-0tp0 Firmware: before 2.7.0 (fixed in 2.7.0)
  • Siemens Captial: before 2019.1 (fixed in 2019.1); version 2019.1 only
  • Siemens Comos: any version
  • Siemens Desigo Cc Advanced Reports: version 4.0 only; version 4.1 only; version 4.2 only; version 5.0 only; version 5.1 only
  • Siemens Desigo Cc Info Center: version 5.0 only; version 5.1 only
  • Siemens E-Car Operation Center: before 2021-12-13 (fixed in 2021-12-13)
  • Siemens Energy Engage: version 3.1 only
  • Siemens Energyip: version 8.5 only; version 8.6 only; version 8.7 only; version 9.0 only
  • Siemens Energyip Prepay: version 3.7 only; version 3.8 only
  • and 30 more

Published 2021-12-14. Last modified 2026-06-17.